A software sensor can be deployed on a virtual machine, on a hypervisor managing a plurality of virtual machines, or within a physical switch (e.g., a switching Application Specific Integrated Circuit (ASIC) or a router).
The sensor reads a configuration file, e.g., a file manually created and updated by an administrator, in order to determine the location at which the sensor has been deployed, e.g., whether the sensor is located on a virtual machine, a hypervisor, or a physical switch, and also, to determine the hypervisor (or physical machine's name and Internet Protocol (IP) address) in case the sensor is located inside a virtual machine. However, use of a configuration file to determine the location of a sensor requires updating the configuration file each time that a new sensor is deployed or when an existing sensor migrates to a new location. Alternatively, the hypervisor environment may be queried using hypervisor-specific Application Programming Interfaces (APIs) and management interfaces provided by various hypervisor environments, e.g., Xen®, Vmware®, KVM®, etc., to determine sensor placement (in terms of its relative placement, and to determine the hypervisor's IP address if the sensor is contained inside a virtual machine). However, both of these approaches are manually driven and time-consuming processes. In addition, these processes are also error prone, especially when a virtual machine containing a sensor is moved to a different machine (or different hypervisor).